@smartledger/bsv 7.11.0 → 7.12.0

package/CHANGELOG.md

@@ -7,6 +7,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.12.0] - 2026-08-10
+
+### The browser bundles lose a fifth of their weight
+
+`crypto-browserify` is a faithful shim for the whole of Node's `crypto`, and the browser
+build used it for the `crypto` built-in. Faithful is the problem: every bundle carried
+AES, DES, Diffie-Hellman, RSA public-encrypt and an ASN.1 parser for code the library
+never calls. Reading the module graph rather than guessing, the bundles need exactly
+three entry points — `createHash` (`hash.node.js`, and the didweb / vcjwt / statuslist /
+anchor / gdaf modules, which `require('crypto')` unconditionally), `createHmac`
+(`mnemonic/pbkdf2.node.js`) and `randomBytes` (secrets.js-grempe's Shamir CSPRNG).
+
+`build/esbuild/crypto-shim.js` provides those three and nothing else. Fourteen packages
+leave the graph; `bsv.min.js` drops from 378 module inputs to 309, and the duplicate
+`bn.js` copy disappears with them.
+
+```
+bsv-anchor.min.js       341,349 →   167,670   -50.9%
+bsv-didweb.min.js       342,010 →   168,331   -50.8%
+bsv-vcjwt.min.js        343,018 →   169,332   -50.6%
+bsv-shamir.min.js       354,058 →   180,342   -49.1%
+bsv-statuslist.min.js   435,810 →   261,944   -39.9%
+bsv-mnemonic.min.js     636,824 →   463,208   -27.3%
+bsv-ltp.min.js          674,540 →   545,227   -19.2%
+bsv.min.js            1,317,994 → 1,187,504    -9.9%
+                      ─────────   ─────────
+total (16 bundles)    7,491,257 → 5,928,232   -20.9%
+```
+
+No API changes. Digests, signatures and Shamir shares are unchanged — the new shim is
+checked against node's own `crypto` for sha1/sha256/sha512/ripemd160 and HMAC-SHA512, and
+the built bundles were additionally verified against NIST SHA-256 known-answer vectors.
+
+`getRandomValues` is deliberately **not** exported. secrets.js prefers it over
+`randomBytes` when present, so exporting it would silently move the Shamir CSPRNG onto a
+different code path; `crypto-browserify` did not expose it either, so omitting it keeps
+the selection identical to every prior release.
+
+### Dependency advisories cleared
+
+Dev-dependency alerts went from 10 (6 high, 2 moderate, 2 low) to **zero**. The
+production tree audited clean throughout — `npm audit --omit=dev` was 0 before and after
+— so no published version was ever affected.
+
+The high and moderate findings (js-yaml, serialize-javascript, tmp) are closed with
+pinned `overrides`, because npm's own suggestions were all wrong: a semver-major jump to
+`standard@17`, a *downgrade* of crypto-browserify, and `mocha@11.3.0` when 11.8.0 was
+already installed. The js-yaml 3.x line has a 3.15.1 backport above the vulnerable range,
+so eslint and istanbul keep the 3.x API instead of being forced to 4.x where `safeLoad`
+no longer exists.
+
+The remaining low finding was `elliptic`, which has no patched version at all. It was
+never our EC implementation — that moved to `@noble/curves` — but arrived transitively
+through crypto-browserify. Removing that polyfill removed the chain entirely.
+
+### Testing
+
+`build/esbuild.js` used to keep `elliptic` out of the output with a hand-written
+`onResolve` stub. That stub is gone, replaced by `test/build/bundle_crypto_shim.js`,
+which asserts no bundle's module graph contains any part of the chain, pins the shim's
+exported surface, and compares its digests against node's. A stub goes silent when it
+stops matching; an assertion does not.
+
 ## [7.11.0] - 2026-08-10
 
 ### The Chronicle default, decided

package/README.md

@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js` |
-| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.11.0/bsv.bundle.js` |
+| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js` |
+| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.11.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.11.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.11.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.11.0/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.12.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.11.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.11.0/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.11.0/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.11.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.11.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.11.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.12.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.12.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.12.0/bsv-mnemonic.min.js` |
 
 ## ⚡ **2-Minute Quick Start**
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
 npm install @smartledger/bsv
 
 # Or include in HTML
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
 ```
 
 > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔧 **Basic Development** (~1.2MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-script-helper.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Security & Cryptography** (~1.5MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🎯 **Everything Bundle** (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);           // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-script-helper.min.js"></script>
 <script>
   const tx = new bsv.Transaction();
   const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = new bsvCovenant.CovenantInterface();
   const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js"></script>
 <script>
   const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
   const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 4. **Everything Bundle** - One File Solution (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
 <script>
   // Everything available under bsv namespace
   const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
 
 See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
 table near the top for the full list of bundles with current sizes and
-canonical `unpkg.com/@smartledger/bsv@7.11.0/...` URLs.
+canonical `unpkg.com/@smartledger/bsv@7.12.0/...` URLs.
 
 ## 🔐 Security